CVE-2026-113601 in Memos
Summary
by MITRE • 10/20/2026
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Memos versions prior to 0.27.0 represents a critical failure in access control mechanisms within the ActivityService module. Specifically, the ListActivities and GetActivity API endpoints lack proper authorization checks that verify whether the requesting user has permission to view the activity records associated with specific memos or users. This architectural flaw allows any authenticated user, regardless of their privilege level, to bypass intended restrictions and retrieve sensitive operational data from the system. The core issue lies in the absence of a validation step that ensures the requester is either the owner of the memo generating the activity or an administrator with explicit rights to view such logs, thereby violating the principle of least privilege essential for secure application design.
From a technical perspective, this missing authorization vulnerability enables low-privileged attackers to perform systematic enumeration attacks against the system's activity records. By iterating through sequential activity identifiers, adversaries can extract detailed metadata including creator user IDs, precise timestamps, and references to memo comments. This capability is particularly dangerous because it allows attackers to map out the social graph of a Memos instance, identifying which users are active, when they perform actions, and how their private memos interact with others through comment threads. The exposure extends beyond public content, as the flaw permits access to activity logs related to memos marked as private by their creators, effectively nullifying the confidentiality guarantees provided by those privacy settings.
The operational impact of this vulnerability is significant for organizations relying on Memos for collaborative knowledge management or secure note-taking. Attackers can leverage the harvested data for further reconnaissance and social engineering campaigns. By analyzing creator IDs and timestamps, an adversary can identify high-value targets based on their activity patterns and peak usage times. The exposure of memo-comment references provides insight into internal discussions and decision-making processes that were intended to remain confidential within specific user groups or private channels. This level of information disclosure facilitates targeted phishing attacks, credential stuffing attempts against identified active users, and potentially the reconstruction of sensitive business logic derived from the content of linked memos.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as it involves a failure to enforce proper restrictions on authenticated users attempting to access resources belonging to others. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts and potentially contributes to reconnaissance activities under T1592 Gather Victim Host Information or T1606 Forge Credentials if combined with other techniques for identity theft. The ability to enumerate sequential IDs also touches upon aspects of information leakage that can aid in broader attack chains, such as identifying system structure through predictable identifier patterns.
To mitigate this vulnerability, administrators must upgrade the Memos instance to version 0.27.0 or later, where these authorization checks have been properly implemented within the ActivityService methods. Until an upgrade is feasible, it is advisable to restrict network access to the API endpoints if possible, although this may not be practical for all deployments. Additionally, implementing strict rate limiting on activity-related API calls can help mitigate the efficiency of enumeration attacks by slowing down the pace at which sequential IDs can be probed. Security monitoring should also be enhanced to detect unusual patterns of requests targeting multiple distinct user activities in rapid succession, which would indicate an ongoing exploitation attempt against this flaw.